Ok, so some of you guys will probably have seen some of my posts... basically I am a newbie Pen Tester and have predominantly starting performing web app assessments.

Unfortunately I don’t have a development background, mainly sys admin and therefore am not up to speed with scripting languages. Now I have decided to learn perl eventually but need a quick understanding of javascript and actionscript as I am not entirely sure what to look for when looking for XSS when the standard alert functions do not work. Don’t get me wrong I have noticed that the standard <script>alert(“xss”)</script> does still get executed a lot on sites but need to get a better understanding of Javascript and how to look for the more discreet vulnerabilities?

When decompiling flash files I generally look for Look for encryption algorithms and salts, directories you can access and enumerate, crossdomain.xml file for * as the domains it can use any more?Any help would be appreciated?

Some websites employ filters in which case the standard alert dialog will not work. You will then have to try various evasion techniques.eg.<script><script>alert('xss')</script></script> So if one <script></script> gets blocked the other passes through.

This does not have much to do with learning javascript or actionscript (but the aforementioned site:w3schools is very good) but have you read The Web Application Hacker's Handbook? It's really good and in depth, and you said that you are starting new with webapp testing. Very robust and if you read a chapter at a time and apply what you learned on a vuln site, it really sticks in your head. In your case, maybe you can make mock-up web apps using javascript/actionscript and try and apply what you learned from that chapter in the book. 2 birds, 1 stone lol.

Actually I am in the process of reading through the Web Application Hackers Handbook at present. I have been performing tasks on a list of vulnerable sites but havent yet got to the "Attacking Other users" chapter which deals with xss... ok ill be patient and will be sure to check out w3schools.